CVE-2020-15229: Path Traversal and Files Overwrite in Singularity
Summary
CVE-2020-15229: Path traversal and files overwrite with unsquashfs in singularity. Affects github.com/sylabs/singularity versions >= 3.1.1, < 3.6.4. Fixed in 3.6.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Singularity is an open-source containerization platform that allows users to run applications in isolated environments. It is written in Go and provides a command-line interface for managing containers. Singularity supports the use of squashfs filesystems, which are compressed read-only file systems commonly used in Linux distributions. However, Singularity's handling of path traversal and lack of path sanitization in the unsquashfs utility can lead to the overwrite or creation of arbitrary files on the host filesystem during the extraction of a crafted squashfs filesystem.
Vulnerability Detail
The vulnerability arises from the insecure handling of path traversal and the absence of path sanitization in unsquashfs. This allows an attacker to manipulate the file paths and overwrite or create files on the host filesystem. The impact of this vulnerability is significant as it can lead to a system compromise. It affects both the execution of Singularity images and the image build process, particularly when performed by the root user. Singularity versions 3.1.1 to 3.6.3 are affected.
How To Fix
Latest published version: v3.1.1+incompatible as of 23 Oct 2026
go get github.com/sylabs/singularity@v3.1.1+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.6.4
This is the first release that contains the fix.
go get github.com/sylabs/singularity@v3.6.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
While there is no solid workaround, users can temporarily avoid unprivileged mode with single file images and instead use sandbox images. For image build, it is advised to temporarily avoid building from library and shub sources and, whenever possible, use --fakeroot or a virtual machine to limit the potential impact.
Conclusion
The vulnerability in Singularity allows for path traversal and files overwrite, potentially leading to a system compromise. Users are advised to upgrade to Singularity 3.6.4 and follow the recommended workarounds to minimize the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/sylabs/singularity →
FAQ
Singularity is an open-source containerization platform that allows users to run applications in isolated environments.
A squashfs filesystem is a compressed read-only file system commonly used in Linux distributions.
The vulnerability arises from the insecure handling of path traversal and the lack of path sanitization in the unsquashfs utility.
The vulnerability allows an attacker to overwrite or create arbitrary files on the host filesystem, potentially leading to a system compromise.
The issue has been addressed in Singularity 3.6.4. Users should upgrade to this version to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/sylabs/singularity.
